EIP-2026-113745

This is a functional CSRF exploit for the File Manager WordPress Plugin (v3.0.1) that allows arbitrary PHP file uploads via a crafted multipart/form-data request. The PoC demonstrates how an attacker can upload a malicious PHP file to the server by leveraging the lack of CSRF protection in the plugin's upload form.